PCSE Multiple Select — 60 Questions

Question 1

A security engineer is investigating an incident where an attacker gained access to a Compute Engine instance's serial console logs, which contained sensitive data. Which TWO actions should the engineer take to prevent this type of exposure in the future? (Choose TWO.)

Accepted Answer

Enable Private Google Access on the VPC subnet to restrict serial console log access to internal IPs only.. Option B is correct because enabling Private Google Access on the VPC subnet ensures that serial console logs are accessed only via internal IP addresses, preventing exposure over the public internet. This restricts access to the serial console logs to resources within the VPC or connected networks, reducing the attack surface for data exfiltration.

Answer

Use Cloud NAT for outbound traffic to anonymize instance IP addresses in serial console logs.

Answer

Remove the roles/iam.serviceAccountUser role from all users to prevent them from accessing serial console.

Answer

Enable OS Login for the project to enforce SSH key management and prevent serial console access.

Question 2

A security engineer is configuring Cloud Armor to protect a global external HTTP(S) Load Balancer. Which TWO of the following are valid Cloud Armor security policies? (Choose two.)

Accepted Answer

Preconfigured OWASP Top 10 rules. Option D is correct because Cloud Armor includes preconfigured rules that map directly to the OWASP Top 10 web application vulnerabilities, such as SQL injection and cross-site scripting (XSS). These rules are managed by Google and automatically updated to protect against the latest attack patterns, making them a valid security policy for a global external HTTP(S) Load Balancer.

Answer

Web Security Scanner scan rule

Answer

Signed URL policy

Answer

Preconfigured Identity-Aware Proxy (IAP) rule

Question 3

Which TWO actions should a security engineer take to protect sensitive data in Cloud Storage buckets from accidental public exposure? (Choose two.)

Accepted Answer

Set the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' to enforce uniform bucket-level access across the organization.. Option B is correct because setting the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' enforces uniform bucket-level access across the organization, preventing the use of fine-grained ACLs that can accidentally expose data. This policy ensures that all new buckets default to IAM-based access control, reducing the risk of misconfigured public ACLs.

Answer

Use Cloud Data Loss Prevention (DLP) to scan buckets for public access.

Answer

Configure VPC Service Controls to restrict access to the buckets from within the VPC.

Answer

Enable bucket lock on all buckets to prevent deletion of objects.

Question 4

A company is implementing a data retention policy for Cloud Storage buckets. They need to ensure that objects cannot be deleted before a specified retention period. Which THREE features can they use? (Choose THREE.)

Accepted Answer

Retention Policy on the bucket.. A is correct because a Retention Policy on a Cloud Storage bucket enforces a minimum retention period for all objects in the bucket. Once set, objects cannot be deleted or overwritten until the retention period expires, directly meeting the requirement to prevent deletion before a specified time.

Answer

Lifecycle rules with a Delete action.

Answer

Object versioning.

Question 5

A global e-commerce company must comply with GDPR and CCPA. They use BigQuery to store customer data and need to ensure that when a user requests data deletion, all copies are deleted within 30 days. Additionally, they want to minimize storage costs. Which TWO actions should they take?

Accepted Answer

Use the DDL statement to drop the table after 30 days using a scheduled query.. Option A is correct because using a DDL statement (e.g., DROP TABLE) in a scheduled query allows you to delete the entire table after exactly 30 days, ensuring all data copies (including storage and any snapshots) are removed. This directly meets the GDPR/CCPA deletion requirement while minimizing storage costs by not retaining data beyond the mandated period.

Answer

Create a Cloud Function to export the data before deletion.

Answer

Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.

Answer

Use BigQuery continuous backups with a 30-day retention.

Question 6

A Security Engineer is designing access controls for a multi-cloud environment where workloads on Google Cloud need to access on-premises databases. The company wants to use long-lived credentials. Which TWO options are valid approaches? (Choose TWO.)

Accepted Answer

Create an OAuth 2.0 client ID for an installed application and use offline access to obtain refresh tokens.. Option A is correct because OAuth 2.0 client IDs for installed applications can be configured for offline access, which returns refresh tokens. These refresh tokens are long-lived (typically do not expire unless revoked) and can be used by on-premises applications to obtain new access tokens for accessing Google Cloud APIs without user interaction. This meets the requirement for long-lived credentials in a multi-cloud environment.

Answer

Set up a Cloud VPN tunnel and use private IP addresses to access Google Cloud services.

Answer

Create a service account and use its key to generate short-lived tokens.

Answer

Use Workload Identity Federation to exchange on-premises credentials for Google Cloud tokens.

Question 7

Your company has a VPC with multiple subnets. You have deployed a set of Compute Engine instances that must communicate with each other over TCP port 4444. The instances are tagged with 'app-tier'. You need to ensure that only these instances can communicate on this port. Which THREE of the following steps are necessary to achieve this?

Accepted Answer

Create an egress firewall rule that allows TCP 4444 from target tag 'app-tier' to source tag 'app-tier'. Option B is correct because egress firewall rules control outbound traffic from instances. By creating an egress rule allowing TCP 4444 from source tag 'app-tier' to destination tag 'app-tier', you ensure that only instances with the 'app-tier' tag can send traffic on that port to other 'app-tier' instances, while all other outbound traffic is implicitly denied by the default deny egress rule (unless overridden by a higher-priority allow rule). This restricts communication to the intended group.

Answer

Remove the default allow egress rule that allows all outbound traffic

Answer

Create a VPC firewall rule to deny all egress traffic from the VPC

Question 8

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Accepted Answer

Use the DLP API to inspect the storage for sensitive data.. Option B is correct because the DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Answer

Create custom infoTypes for all sensitive data.

Answer

Store de-identification templates in Cloud KMS.

Answer

Use VPC Service Controls to restrict access to the data.

Question 9

A security engineer is investigating a potential data breach in a Google Cloud environment. The engineer suspects that a compromised service account key was used to access Cloud Storage buckets. Which TWO actions should the engineer take immediately to mitigate the risk?

Accepted Answer

Disable the service account. Disabling the service account immediately stops all access using any of its keys, including the compromised one, without deleting the account or its configuration. This is the fastest way to block the attacker while preserving the ability to investigate and re-enable the account later if needed. In Google Cloud, disabling a service account is a reversible action that revokes all authentication and authorization for that identity.

Answer

Revoke all IAM roles granted to the service account

Answer

Rotate the service account key

Answer

Enable Cloud Audit Logs for the service account

Question 10

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 11

Which TWO options are valid methods to secure data in transit between an on-premises data center and a Google Cloud VPC?

Accepted Answer

Dedicated Interconnect with MACsec. Dedicated Interconnect with MACsec (Media Access Control Security) provides encryption at Layer 2, securing data in transit over the dedicated connection between your on-premises data center and Google Cloud VPC. MACsec uses GCM-AES-128 or GCM-AES-256 encryption to protect all traffic on the link, ensuring confidentiality and integrity without the overhead of IPsec.

Answer

Private Google Access

Answer

VPC Network Peering

Answer

Internal HTTPS Load Balancing

Question 12

A security team is designing access controls for a multi-tenant SaaS application on Google Kubernetes Engine (GKE). Each tenant has a separate namespace. They want to ensure that a DevOps team can manage deployments across all namespaces, but cannot modify secrets in the 'tenant-alpha' namespace. Which THREE Kubernetes RBAC resources should be created? (Choose THREE)

Accepted Answer

A RoleBinding in namespace 'tenant-alpha' that binds the ClusterRole to the DevOps team.. Option A is correct because a RoleBinding in the 'tenant-alpha' namespace can bind a ClusterRole (which is a cluster-scoped resource) to the DevOps team, granting them the permissions defined in that ClusterRole within that specific namespace. Since the ClusterRole in option D explicitly excludes secrets, this RoleBinding ensures the DevOps team can manage deployments across all namespaces (via a ClusterRoleBinding) but cannot modify secrets in 'tenant-alpha'.

Answer

A ClusterRole that grants permissions to manage secrets across all namespaces.

Answer

A RoleBinding in namespace 'tenant-alpha' that binds a Role granting secret modification to the DevOps team.

Question 13

A company uses BigQuery to store sensitive data and wants to implement data masking using policy tags. They have three user groups: data_engineers (full access), data_analysts (masked PII), and data_scientists (masked financial data). Which THREE steps should they take?

Accepted Answer

Publish the taxonomy to make the policy tags available for use.. Option A is correct because after creating a taxonomy with policy tags in Cloud Data Catalog, you must publish the taxonomy to make those policy tags available for use in BigQuery. Publishing associates the taxonomy with the project and allows BigQuery to enforce data masking rules based on the policy tags applied to columns.

Answer

Apply only one policy tag per column.

Answer

Enable Cloud Audit Logs to track policy tag usage.

Question 14

Which THREE steps are required to implement field-level encryption for sensitive columns in a Cloud SQL for PostgreSQL database using Cloud KMS? (Choose three.)

Accepted Answer

Create a symmetric encryption key in Cloud KMS.. Option A is correct because Cloud KMS symmetric encryption keys are used to encrypt data encryption keys (DEKs) that protect the column data. In field-level encryption, the application or database encrypts each column value using a DEK, which is then wrapped (encrypted) by a Cloud KMS key. This ensures the sensitive data is encrypted at the application layer, independent of the underlying storage encryption.

Answer

Configure a Cloud HSM key to generate the data encryption key.

Answer

Enable CMEK on the Cloud SQL instance.

Question 15

You are a security engineer for a healthcare organization. You need to protect sensitive patient data stored in Cloud Storage. You want to ensure that data is encrypted at rest using a customer-managed key (CMEK) and that access to the key is logged. You also need to prevent data exfiltration by limiting which service accounts can decrypt data. Which TWO steps should you take? (Choose two.)

Accepted Answer

Configure a VPC Service Controls perimeter that includes the Cloud Storage bucket and the KMS key.. Option A is correct because VPC Service Controls creates a security perimeter around the Cloud Storage bucket and the KMS key, preventing data exfiltration by blocking unauthorized service accounts from decrypting data outside the perimeter. Option E is correct because creating a Cloud KMS key ring and key, configuring the bucket to use CMEK, and enabling Cloud Audit Logs for the KMS key ensures encryption at rest with a customer-managed key and logs all access to the key, meeting both requirements.

Answer

Use Cloud HSM to create and manage the encryption key, and disable Cloud Audit Logs for the HSM key.

Answer

Enable default encryption (Google-managed key) on the bucket and use Cloud Audit Logs to monitor access.

Answer

Use customer-supplied encryption keys (CSEK) and store the key in Cloud Key Management Service (KMS).

Question 16

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. The perimeter is defined with the project as a protected project. Which TWO actions are valid to restrict data exfiltration while maintaining necessary access?

Accepted Answer

Configure the service perimeter to allow access from the VPC network where the Compute Engine instances reside using private Google access.. Option B is correct because VPC Service Controls can allow traffic from a specific VPC network via private Google access, which uses RFC 1918 addresses and does not traverse the public internet. This restricts data exfiltration by ensuring that only resources within the defined VPC can access the protected services, while still allowing legitimate Compute Engine instances to reach Cloud Storage and BigQuery within the perimeter.

Answer

Use VPC Service Controls to block access to the Compute Engine metadata server to prevent credential extraction.

Answer

Create a service perimeter that includes all Google Cloud projects in the organization to simplify management.

Answer

Use VPC Service Controls to restrict access based on network tags on Compute Engine instances.

Question 17

A security engineer needs to set up access for a new team that will manage Cloud Storage buckets and objects. Which three IAM roles might be appropriate based on least privilege? (Choose three.)

Accepted Answer

roles/storage.objectAdmin. Option A (roles/storage.objectAdmin) is correct because it grants full control over objects in Cloud Storage buckets, including listing, reading, creating, and deleting objects, but does not allow modifying bucket-level permissions or deleting buckets. This aligns with least privilege for a team that needs to manage objects without full bucket administration.

Answer

roles/storage.legacyBucketOwner

Answer

roles/storage.admin

Question 18

A company needs to comply with the General Data Protection Regulation (GDPR). They are using BigQuery to store personal data. Which THREE measures should they implement to meet GDPR requirements?

Accepted Answer

Enable audit logs via Cloud Audit Logs to track access to personal data.. Option A is correct because Cloud Audit Logs provide a comprehensive, immutable record of all administrative and data access activities in BigQuery, which is essential for demonstrating GDPR compliance through accountability and traceability. By enabling audit logs, the company can track who accessed personal data, when, and from where, fulfilling the GDPR requirement to maintain records of processing activities.

Answer

Use Cloud KMS to encrypt individual columns containing personal data.

Answer

Store data in a multi-region location like 'EU' to ensure availability across regions.

Question 19

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Accepted Answer

Define an Organization Policy with constraints/gcp.resourceLocations to allow resource creation only in EU regions.. Option D is correct because the Organization Policy constraint `gcp.resourceLocations` explicitly restricts the Google Cloud regions where resources can be created. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), you enforce that all new resources are provisioned within the European Union, directly meeting GDPR data residency requirements. This policy is evaluated at resource creation time and prevents any resource from being deployed outside the allowed locations.

Answer

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Answer

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Answer

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Question 20

Which THREE of the following are valid requirements for using VPC Network Peering? (Choose three.)

Accepted Answer

Subnet routes are automatically exchanged between the peered VPCs.. Option B is correct because VPC Network Peering automatically exchanges subnet routes between the peered VPCs, enabling private IP connectivity without requiring additional route tables or VPN gateways. This route exchange is implicit once the peering connection is established, provided the networks do not have overlapping CIDR blocks.

Answer

Cloud NAT must be configured in at least one VPC.

Answer

An IAM role with compute.networkAdmin must be granted to all users.